Adobe plugs up buffer overflow holes in Shockwave update

Adobe released a patch for its Shockwave Player software on Tuesday, addressing six security vulnerabilities that might easily lend themselves to malware-pushing exploits.

Shockwave Player 11.6.7.637 and earlier versions on both Windows and Mac need updating to the latest version: Shockwave Player 11.6.8.638.

Adobe said it was not aware of any exploits in the wild, so there's no need for panic, but since vulnerabilities in Adobe software applications have become a major target for the bad guys over the last two or three years, dismissing the update as unimportant would be equally unwise.

Adobe credited security researchers at Fortinet's FortiGuard Labs and CERT for help in discovering the security bugs in its software. A security advisory from Adobe explains that the security bugs in Shockwave involve a mix of buffer overflow vulnerabilities as well as an "array out of bounds" security bug, all of which could result in code execution on systems running the vulnerable software. ®